Tp Link
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in any Tp Link product.
RSS Feeds for Tp Link security vulnerabilities
Create a CVE RSS feed including security vulnerabilities found in Tp Link products with stack.watch. Just hit watch, then grab your custom RSS feed url.
Products by Tp Link Sorted by Most Security Vulnerabilities since 2018
Known Exploited Tp Link Vulnerabilities
The following Tp Link vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability |
TP-Link TL-WR841N contains an authentication bypass by spoofing vulnerability within the httpd service, which listens on TCP port 80 by default, leading to the disclose of stored credentials. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2023-50224 Exploit Probability: 17.5% |
September 3, 2025 |
| TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability |
TP-Link Archer C7(EU) and TL-WR841N/ND(MS) contain an OS command injection vulnerability that exists in the Parental Control page. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2025-9377 Exploit Probability: 11.7% |
September 3, 2025 |
| TP-link TL-WA855RE Missing Authentication for Critical Function Vulnerability |
TP-link TL-WA855RE contains a missing authentication for critical function vulnerability. This vulnerability could allow an unauthenticated attacker (on the same network) to submit a TDDP_RESET POST request for a factory reset and reboot. The attacker can then obtain incorrect access control by setting a new administrative password. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2020-24363 Exploit Probability: 20.7% |
September 2, 2025 |
| TP-Link Multiple Routers Command Injection Vulnerability |
TP-Link TL-WR940N V2/V4, TL-WR841N V8/V10, and TL-WR740N V1/V2 contain a command injection vulnerability via the component /userRpm/WlanNetworkRpm. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2023-33538 Exploit Probability: 41.9% |
June 16, 2025 |
| TP-Link Archer AX-21 Command Injection Vulnerability |
TP-Link Archer AX-21 contains a command injection vulnerability that allows for remote code execution. CVE-2023-1389 Exploit Probability: 100.0% |
May 1, 2023 |
| TP-Link Multiple Archer Devices Directory Traversal Vulnerability |
Directory traversal vulnerability in multiple TP-Link Archer devices allows remote attackers to read arbitrary files via a .. (dot dot) in the PATH_INFO to login/. CVE-2015-3035 Exploit Probability: 83.7% |
March 25, 2022 |
Of the known exploited vulnerabilities above, 2 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings. 4 known exploited Tp Link vulnerabilities are in the top 5% (95th percentile or greater) of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 138 vulnerabilities in Tp Link with an average score of 7.2 out of ten. Last year, in 2025 Tp Link had 32 security vulnerabilities published. That is, 106 more vulnerabilities have already been reported in 2026 as compared to last year. Last year, the average CVE base score was greater by 0.23
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 138 | 7.22 |
| 2025 | 32 | 7.45 |
| 2024 | 59 | 7.52 |
| 2023 | 40 | 8.55 |
| 2022 | 11 | 7.00 |
| 2021 | 0 | 0.00 |
| 2020 | 12 | 0.00 |
| 2019 | 0 | 0.00 |
| 2018 | 7 | 9.80 |
It may take a day or so for new Tp Link vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent Tp Link Security Vulnerabilities
| CVE | Date | Vulnerability | Products |
|---|---|---|---|
| CVE-2026-17252 | Aug 21, 2026 |
Stack-based OOB Write in TP-Link TL-MR6400 v7 Web Admin (CVE-2026-17252)A stack-based out-of-bounds write vulnerability exists in the login request handling functionality of the administrative web interface of TP-Link TL-MR6400 v7 routers. An unauthenticated adjacent attacker can trigger the vulnerability by sending a specially crafted malformed HTTP request. Successful exploitation may cause the web service process to crash, resulting in a denial-of-service condition and temporary loss of access to the router's web management interface. |
|
| CVE-2026-17251 | Aug 21, 2026 |
TP-Link TL-MR6400 v7 Null Pointer in HTTP Request Parsing (DoS)A NULL pointer dereference vulnerability exists in the HTTP request parsing functionality of TL-MR6400 v7. An unauthenticated remote attacker can trigger the vulnerability by sending a specially crafted HTTP request containing a malformed session cookie header. Successful exploitation may cause the HTTP service process to crash, resulting in a denial-of-service condition and temporary loss of management or CGI functionality until service recovery. |
|
| CVE-2026-17250 | Aug 21, 2026 |
TL-MR6400 v7 Firmware Buffer Overflow Enables RCEA stack-based buffer overflow vulnerability exists in the firmware update functionality of TL-MR6400 v7 due to unsafe processing of attacker-controlled metadata within a firmware image. Successful exploitation may allow an authenticated attacker to trigger memory corruption and execute arbitrary code on the affected device. |
|
| CVE-2026-19683 | Aug 20, 2026 |
Unencrypted DDNS Credential Transmission in TP-Link Omada GatewayA vulnerability exists in the Dynamic DNS (DDNS) functionality of TP-Link Omada Gateways. During communication with a third-party DDNS service, authentication credentials are transmitted over an unencrypted channel. An attacker who can observe or manipulate traffic between an affected device and the DDNS service may obtain sensitive authentication information or interfere with DDNS update operations. Exploitation requires DDNS to be configured, communication with an external DDNS service, and attacker visibility or control of the relevant network path. Successful exploitation may result in disclosure of DDNS account credentials, unauthorized access to DDNS management functionality, or modification of DNS records associated with the affected deployment. |
|
| CVE-2026-19586 | Aug 20, 2026 |
TP-Link Omada Gateway OpenVPN Server Command InjectionA pre-authentication OS command injection vulnerability has been identified in Omada gateways configured to operate as an OpenVPN Server due to insufficient validation of client-supplied data during OpenVPN connection establishment. An unauthenticated remote attacker may provide specially crafted input influencing backend command execution logic before authentication completes. Exploitation requires the OpenVPN Server feature to be enabled, VPN service reachable by the attacker and attacker to be able to initiate an OpenVPN connection attempt. Successful exploitation may allow arbitrary command execution, potentially leading to full compromise of the affected device. |
|
| CVE-2026-9033 | Aug 20, 2026 |
TP-Link Captive Portal Session Termination (CVE-2026-9033)An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful exploitation may allow termination of individual or all active captive portal sessions, causing temporary service disruption and requiring users to re-authenticate. |
|
| CVE-2026-8619 | Aug 19, 2026 |
TP-Link TL-MR100 v3.2 HTTP DoS via NULL-pointerAn unauthenticated denial-of-service vulnerability was identified in TP-Link TL-MR100 v3.2, TL-MR150 v3.2, TL-MR6400 v8.0 and Archer MR600 v2, due to improper handling of exceptional request conditions that may lead to a NULL pointer dereference. A remote attacker on an adjacent network can send a specially crated HTTP request to trigger a crash of the HTTP service process. Successful exploitation may cause the HTTP service to crash, making the web management interface and HTTP-dependent functionality temporarily unavailable. |
|
| CVE-2026-75616 | Aug 19, 2026 |
TP-Link Archer C20 v6 OS Command Injection via WAN ConfigAn OS command injection vulnerability exists in the web management interface of Archer C20 v6 firmware when processing certain WAN-related configuration operations. An authenticated administrator may exploit insufficient input validation to execute arbitrary system commands, potentially resulting in full device compromise. Successful exploitation may allow arbitrary command execution with elevated privileges, compromising the confidentiality, integrity, and availability of the affected device and network traffic passing through it. |
|
| CVE-2026-75619 | Aug 19, 2026 |
TP-Link Tapo C100/C101 RTSP Heap Buffer Overflow DoSTapo C100/C101 V5 contains a heap-based buffer overflow vulnerability in the RTSP service. An authenticated attacker on the local network can send specially crafted RTSP frame data containing oversized length values, resulting in out-of-bounds heap writes. Successful exploitation can crash the RTSP service and trigger a device reboot, resulting in a temporary denial-of-service condition. |
Tapo
|
| CVE-2026-75618 | Aug 19, 2026 |
Tapo C100/C101 V5 RTSP Null Pointer DoSTapo C100/C101 V5 contains a null pointer dereference vulnerability in the RTSP service. An attacker on the local network can send specially crafted requests that cause the service to dereference an invalid pointer, resulting in a service crash and device reboot. Successful exploitation can disrupt live video streaming functionality and cause a temporary denial-of-service condition. |
Tapo
|
| CVE-2026-15316 | Aug 18, 2026 |
DoS via Oversized Ciphertext in Tapo C200 Config ServiceAn improper input validation vulnerability in the configuration service for processing encrypted credential data has been identified in Tapo C200 v5. An attacker can send oversized crypted ciphertext values that may trigger exception handling failures, due to insufficient validation, causing the affected device to crash or restart. Successful exploitation may temporarily disrupt HTTPS management and monitoring functionality, resulting in a denial-of-service (DoS) condition until the service recovers. |
Tapo
|
| CVE-2026-15315 | Aug 18, 2026 |
Tapo C200 v5 Improper Auth Allows Local Priv Escalation & DoSTapo C200 v5 contains an improper authentication vulnerability within the login authentication verification module. An attacker on the local network can exploit weaknesses in challenge parameter validation to bypass normal authentication controls and obtain administrative session tokens. Successful exploitation may allow an attacker to subsequently execute privileged management actions, enable unauthorized administrative access and temporary disruption of device services, resulting in a denial-of-service (DoS) condition. |
Tapo
|
| CVE-2026-15141 | Aug 12, 2026 |
TP-Link Router Referrer Header Bypass in Web UI Enables Config DisclosureThe web interface of the affected device relies on the HTTP referrer header as part of request validation. Requests containing empty Referer value, or omitting the Referer header entirely, may be accepted and processed due to insufficient validation logic. Successful exploitation may allow an adjacent attacker with access to the web management interface to obtain device configuration details and other sensitive information. |
|
| CVE-2025-30241 | Aug 10, 2026 |
Cmd. Injection in TP-Link Aginet Web UICertain web interface components in affected TP-Link Aginet devices do not validate and sanitize user-supplied input properly before passing it to system-level command execution functions. An authenticated adjacent attacker may inject specially crafted input to execute arbitrary operation system commands with elevated privileges. Successful exploitation may allow execution of arbitrary system commands, potentially leading to full device compromise. |
|
| CVE-2025-30240 | Aug 10, 2026 |
TP-Link AgNet Symbolic Link Validation Bypass via USB (File Read)The affected TP-Link Aginet devices do not properly validate symbolic links created on external USB storage devices. By placing a crafted symbolic link on supported storage media, an attacker may cause the system to resolve the link. Successful exploitation may allow unauthorized read access to sensitive files within the device filesystem. |
|
| CVE-2025-30239 | Aug 10, 2026 |
TP-Link Aginet Hardcoded Crypto Key Exposure Enables Decryption of Config DataIn affected TP-Link Aginet devices, use of hardcoded cryptographic keys embedded in the firmware to protect sensitive configuration data may allow an attacker who has access to device storage to recover the keys and decrypt stored data. Successful exploitation may allow access to decrypted sensitive configuration data, including credentials and service-related information. |
|
| CVE-2025-30238 | Aug 10, 2026 |
TP-Link Aginet Auth Bypass: Low-Priv Users Gain Admin RightsIn affected TP-Link Aginet devices, insufficient authorization validation allows authenticated low-privileged users to execute higher-privileged operations. An attacker may perform administrative actions such as creating privileged accounts or modifying critical configuration settings. |
|
| CVE-2025-30237 | Aug 10, 2026 |
Unauth Access Bypass on TP-Link Aginet Web UIThe affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke privileged functionality without valid credentials. This issue arises from improper enforcement of access control mechanisms on sensitive operations. Successful exploitation may allow an unauthenticated attacker to execute privileged operations and gain full control of the device. |
|
| CVE-2026-12339 | Aug 10, 2026 |
CVE-2026-12339: Zip Slip in TP-Link WebUI Upgrade Admin File OverwriteA Zip Slip vulnerability in the WebUI ISP Upgrade functionality allows arbitrary file write via a crafted archive containing directory traversal sequences. An authenticated administrator may overwrite arbitrary files on the system.Successful exploitation may allow arbitrary file to overwrite on the underlying system, affecting system integrity and availability. |
|
| CVE-2026-9031 | Aug 07, 2026 |
TP-Link HTTP-WRITEOEM Flash Write DoS via Insufficient Input ValidationAn input validation vulnerability exists in the HTTP-WRITEOEM handler due to insufficient validation of user-supplied data before it is processed by internal flash-write handling logic. Successful exploitation may cause httpd process or device to crash, resulting in loss of access to the web interface and a denial-of-service condition. |
|
| CVE-2026-9030 | Aug 07, 2026 |
TP-Link Archer A6 v4 HTTPD Async Systool DoS via Race ConditionA denial-of-service vulnerability exists in httpd service on Archer A6 v4 where the asynchronous systool instruction handlng path in httpd does not properly synchronize or safely manage concurrent systool operations. By sending crafted systool instructions through the asynchronous request path, successful exploitation may cause the httpd process or device management service to crash and may result in temporary loss of access to the web management interface or device reboot. |
|
| CVE-2026-15314 | Aug 04, 2026 |
Buffer Overflow in Tapo P110 HTTP Body Handling Leads to DoSTapo P110 v1 smart Wi-Fi Plug contains an improper boundary validation vulnerability in the handling of authenticated HTTP request bodies due to insufficient input validation before memory copy operations. This may lead to buffer overflow condition, causing the web service process to crash. Successful exploitation may cause the web service process to stop responding or restart, resulting in a denial-of-service condition. |
|
| CVE-2025-15631 | Aug 03, 2026 |
TP-Link Omada Cred Hash WeaknessA cryptographic weakness exists in affected Omada devices where site credentials are protected using a legacy hashing algorithm that does not provide sufficient protection. An attacker who obtains access to stored credential data may be able to recover valid credentials to gain unauthorized access to affected devices or management environments. |
Omada
|
| CVE-2025-15630 | Aug 03, 2026 |
CVE-2025-15630: Race Condition in Omada AdoptionA race condition exists in the cloud-based Omada device adoption process when an attacker may be able to interact with the adoption workflow before a legitimate device completes registration, resulting in provisioning information being delivered to an attacker. Successful exploitation may allow disclosure of provisioning information intended for a legitimate device. |
Omada
|
| CVE-2025-9291 | Aug 03, 2026 |
TP-Link Omada Gateway Cert Validation Bypass (CVE-2025-9291)A certification validation weakness exists in communication between affected Omada devices and cloud controllers. Certificate identity verification does not adequately validate that a presented certificate corresponds to the expected cloud controller hostname, which may allow certificate validation protections to be bypassed under specific conditions. Successful exploitation may allow interception or modification of communication between affected devices and cloud controllers. |
Omada
|
| CVE-2026-9044 | Jul 31, 2026 |
TP-Link AXE75 V1 OpenVPN Command Injection (pre-1.5.6 Build 20260623)An OS command injection vulnerability exists in the VPN module of TP-Link AXE75 V1 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue arises from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability. |
|
| CVE-2026-12935 | Jul 29, 2026 |
TL-WR940N RTSP Buffer Overflow Enables RCEThe TL-WR940N v6 router contains a vulnerability in its RTSP connection tracking module that can lead to a stack-based buffer overflow. The issue occurs when a LAN client initiates a connection to a malicious RTSP server controlled by an attacker. A specially crafted RTSP message may trigger improper memory handling within the kernel module Successful exploitation of this vulnerability may result in a denial-of-service (DoS) condition or allow remote code execution (RCE), potentially leading to full compromise of the device. This vulnerability can be exploited by an unauthenticated attacker under the device's default configuration. |
|
| CVE-2026-12001 | Jul 27, 2026 |
TP-Link Router Firmware Hardcoded Credential Exposure in FirmwareA hardcoded credential vulnerability exists in the firmware of multiple TP-Link routers (TL-WR845N v4, TL-WR850N v3, TL-WR902AC v4, Archer C20 v6 & Archer MR200 v5). Authentication-related credential material is embedded within a password file in the firmware image and may be recovered through firmware analysis. Successful exploitation could result in unauthorized access to privileged functions on affected devices. |
|
| CVE-2026-13230 | Jul 15, 2026 |
TP-Link Kasa EC70/EC71 v4 Local Discovery Geo-Info DisclosureAn information disclosure vulnerability was identified in TP-Link Kasa EC70 v4 and EC71 v4 in the local discovery mechanism, which exposes sensitive geolocation information without requiring authentication. This issue allows an attacker on the same local network to retrieve geolocation-related data through crafted responses. The vulnerability impacts confidentiality only, with no evidence of integrity of availability impact. |
|
| CVE-2026-9770 | Jul 15, 2026 |
TP-Link Kasa EC71/EC70 v4 Static Private Key Leak Enables MITMKasa EC71 v4 and EC70 v4 firmware contains a static cryptographic private key stored in a read-only filesystem that is shared across devices. An attacker with access to the firmware image can extract the embedded key. Successful exploitation may allow an unauthenticated attacker on the same network to use this key in the web management service, compromising the confidentiality of encrypted communications. This may enable passive decryption of traffic or active man-in-the-middle (MITM) attacks |
|
| CVE-2026-5040 | Jul 14, 2026 |
TP-Link Deco M5 Weak Password Hashing Enables Credentials DisclosureTP-Link Deco M5 v1 uses a weak password hashing mechanism to store user credentials. An attacker who obtains the password hash through system compromise or privileged access could perform brute-force or dictionary attacks. Successful exploitation may result in disclosure of authentication credentials, enabling unauthorized access to device management functions, depending on the privileges associated with the recovered password. The primary security impact is loss of confidentiality. |
|
| CVE-2026-15429 | Jul 14, 2026 |
TP-Link Archer VX1800v: HTTP Auth Input Tainted Leads to Priv EscalationA privilege escalation vulnerability exists in the HTTP authentication component in Archer VX1800v v1. Improper handling of user-controlled input may allow newline characters to be injected into internally constructed configuration data. An authenticated user with sufficient privileges may be able to modify account settings and gain elevated administrative privileges. |
|
| CVE-2026-15428 | Jul 14, 2026 |
TP-Link Archer VX800v v1 Root RCE via OS Command InjectionAn OS command injection vulnerability exists in Archer VX800v v1 due to insufficient input sanitization of the domain name parameter. An adjacent attacker who can access the relevant HTTP interface can modify the parameter to inject shell metacharacters, resulting in arbitrary code execution with root privileges. Successful exploitation may allow remote code execution and complete compromise of the device. |
|
| CVE-2026-15427 | Jul 14, 2026 |
CVE-2026-15427 TP-Link Archer VX1800v V1 OS Command Injection via TR-069/CWMPAn OS command injection vulnerability exists in the TR-069 / CWMP management interface of Archer VX1800v v1 due to insufficient input validation and sanitization of parameters, allowing crafted input to be executed as system-level commands. Exploitation requires specific conditions such as TR-069 being enabled and ability to influence ACS-delivered commands, compromise or control an ACS server. Successful exploitation may allow arbitrary command execution with root privileges, resulting in complete compromise of the device. |
|
| CVE-2026-8699 | Jul 02, 2026 |
XSS in Archer C5 v6.8 Management Interface Enables JS ExecutionA stored Cross-Site Scripting (XSS) vulnerability has been identified in the web-based management interface of Archer C5 v6.8 routers, due to insufficient server-side validation and lack of proper output encoding of user-controlled input in a certain field. An attacker with administrative privileges can inject crafted HTML or JS payloads into the affected field. The payload is stored and later executed when the affected page is rendered in an administrator's browser.Successful exploitation allows execution of arbitrary JavaScript in an admin's browser, potentially leading to session hijacking and unauthorized access to router configuration, possibly resulting in exposure of sensitive data and modification of device settings. The vulnerability affects ISP-managed firmware variants of the product. Remediation is coordinated through service providers. |
|
| CVE-2026-10562 | Jun 30, 2026 |
Unauth URL Redirect in TP-Link Archer AX20 v2.1.9 Build 20230829An unauthenticated URL redirection vulnerability has been identified in Archer AX20 V2 due to improper validation of user-supplied URL input within the web interface. An unauthenticated attacker can craft URLs containing URL-encoded path traversal sequences. When processed by the embedded web server, these inputs may cause the device to respond with HTTP 3xx redirects to attacker-controlled external domains. This issue affects Archer AX20 V2.0: through 2.1.9 Build 20230829. |
|
| CVE-2026-9105 | Jun 29, 2026 |
Authenticated stack buffer overflow in TP-Link TLWR841N web server causes DoSAn authenticated stack-based buffer overflow vulnerability exists in the web management interface of TP-Link TL-WR841N v14. A remote authenticated attacker can send crafted HTTP requests to cause the embedded web server to overflow a stack buffer, resulting in a crash of the affected process. Successful exploitation results in a denial-of-service condition, causing the device to crash and automatically reboot. |
|
| CVE-2026-12760 | Jun 24, 2026 |
TP-Link Tapo C200 v3 DoS via improper IPv4 fragmentation handlingA denial-of-service (DoS) vulnerability has been identified in Tapo C200 v3 in the network packet handling logic due to improper handling of IPv4 fragmented packets. An unauthenticated adjacent attacker can send crafted packets to cause excessive resource consumption, leading to instability of the device.Successful exploitation can remotely trigger a temporary denial-of-service condition, causing the camera to become unresponsive and resulting in intermittent loss of video monitoring and recording. |
Tapo
|
| CVE-2026-11834 | Jun 22, 2026 |
TP-Link Router Command Injection via DHCP Option ProcessingA command injection vulnerability has been identified in the DHCP option processing logic in multiple TP-Link router models, due to insufficient validation of externally supplied DHCP option data. An adjacent attacker may exploit this vulnerability by supplying crafted DHCP responses, potentially resulting in unauthorized command execution during device initialization or provisioning workflows. This typically occurs when the device is in a factory-default or unconfigured state. Successful exploitation may allow an adjacent, unauthenticated attacker to execute arbitrary commands with elevated privileges, potentially leading to full compromise of the affected device and unauthorized administrative control. |
|
| CVE-2026-11409 | Jun 16, 2026 |
OS Command Injection via IPv6 PPPoE in TP-Link TL-WR940N v6An authenticated OS command injection vulnerability exists in the IPv6 PPPoE configuration handler in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges. |
|
| CVE-2026-11410 | Jun 16, 2026 |
Authenticated OS Command Injection in TP-Link TL-WR940N v6An authenticated OS command injection vulnerability exists in the BigPond Cable (BPA) WAN configuration module in TL-WR940N v6 due to improper sanitization of user input. An attacker with administrative access may exploit this issue to execute arbitrary system commands with elevated privileges. |
|
| CVE-2026-6250 | Jun 11, 2026 |
Tapo C110 Authenticated Format String in ONVIF ServiceAn authenticated format string vulnerability exists in the ONVIF service of Tapo C110 v2 due to improper handling of user-controlled input. Externally controlled data is interpreted as a format string, which can be used to manipulate stack memory, including control flow data such as return addresses. A remote authenticated attacker may redirect execution flow to existing internal functions, triggering an unauthorized factory reset, leading to loss of configuration, deletion of stored credentials and service disruption. |
Tapo
|
| CVE-2026-9151 | Jun 10, 2026 |
TP-Link Archer VPN Module OS Command Injection v1 & v1.6An OS command injection vulnerability exists in the VPN module of TP-Link Archer AX12 v1, AX17 v1. AX18 v1, and AX1300 v1.6 routers. This vulnerability allows an adjacent, authenticated attacker to execute arbitrary commands on the device by importing a specially crafted VPN client configuration file. The issue stems from improper filtering of special characters. Successful exploitation of this vulnerability may enable an attacker to gain full control of the affected device, potentially compromising configuration integrity, network security, and service availability. |
|
| CVE-2026-8913 | Jun 08, 2026 |
Command Injection in TP-Link Archer MR600 WireGuardA command Injection vulnerability exists in the WireGuard client configuration of Archer MR600 v5 due to improper neutralization of user-controlled input within the web management interface. An authenticated attacker with administrative privileges may be able to execute arbitrary commands when applying configuration changes.Successful exploitation may result in a full compromise of confidentiality, integrity, and availability of the affected device. |
|
| CVE-2026-6242 | Jun 05, 2026 |
Authenticated Format String in Tapo C520WS Subscribe ServiceAn authenticated format string vulnerability exists in the ONVIF Subscribe service in Tapo C520WS v2 due to improper handling of externally supplied parameters within formatting functions. An attacker may inject crafted format strings into event subscription requests or notification generation path to disrupt normal service execution. Successful exploitation may cause the event notification service to terminate unexpectedly, resulting in the loss of real-time alarm functionality and disruption of event notifications. |
Tapo
|
| CVE-2026-6241 | Jun 05, 2026 |
Auth Format String DoS via ONVIF AddScopes in Tapo C520WS v2An authenticated format string vulnerability is present in the ONVIF AddScopes in Tapo C520WS v2, where user-controlled input is improperly passed to formatting functions without adequate sanitization. An attacker can inject format specifiers into ONVIF scope parameters to manipulate memory handling behavior. Successful exploitation may cause the ONVIF management service to crash, resulting in DoS condition that impacts normal device operation. |
Tapo
|
| CVE-2026-6240 | Jun 05, 2026 |
Stack Buffer Overflow in Tapo C520WS v2 ONVIF DeleteUsers (DoS)A stack-based buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF DeleteUsers service, due to insufficient boundary checks when handling multiple user deletion parameters. An authenticated attacker can send a crafted malicious request containing an excessive number of identifiers to overflow stack memory. Successful exploitation may result in a service crash or deadlock, leading to DoS affecting device management and monitoring functionality. |
Tapo
|
| CVE-2026-6239 | Jun 05, 2026 |
Tapo C520WS v2 DoS via ONVIF CreateUsers stackoverflowA stackbased buffer overflow vulnerability exists in Tapo C520WS v2 in the ONVIF CreateUsers service, where the device fails to properly validate the number of XML user nodes during request processing. An authenticated attacker can send a specially crafted ONVIF request containing an excessive number of user entries to trigger memory corruption. Successful exploitation may cause the ONVIF management service to terminate unexpectedly, resulting in a denialofservice (DoS) condition that disrupts device configuration and management functions. |
Tapo
|
| CVE-2026-34123 | Jun 05, 2026 |
Tapo C520WS v2 API Auth Bypass Lets Restricted Accounts Execute Sensitive OpsOn Tapo C520WS v2, restricted accounts (for example, hub users) are intended to execute only a limited set of lowsensitivity operations. Due to a logic flaw in the devices API authorization mechanism, an attacker can craft requests that leverage legitimate method mapping behavior to bypass whitelist restrictions, allowing restricted operations to be masked as permitted requests and executed. Successful exploitation may allow an attacker (with access to a restricted account) to execute unauthorized sensitive operations. Depending on the operation invoked, impact could include device resets, unintended configuration changes, or disruption of normal operation, leading to loss of availability and integrity of the device. |
Tapo
|
| CVE-2026-8714 | Jun 05, 2026 |
DoS via RTSP in TPLink Tapo C520WS v2A denial-of-service vulnerability exists in the RTSP server component of TP-Link Tapo C520WS v2 due to improper handling of syntactically invalid input. Crafted inputs can trigger a processing error, causing the RTSP service to enter non-responsive state. Successful exploitation may cause the RTSP in a denial-of-service condition. |
Tapo
|